       (>! ch (assoc context :response (assoc response
                                              :headers {"Location" github-redirect}
                                              :status 302
-                                             :body ""))))
+                                             :body nil))))
     ch))
 
 (defbefore github-callback
   [{:keys [request response] :as context}]
   (let [ch (chan 1)
-        {:keys [client-id client-secret]} (get-github-settings context)
-        {:keys [code state]} (:query-params request)
-        github-access-token-endpoint (str github-access-token-url
-                                          "?client_id=" client-id
-                                          "&client_secret=" client-secret
-                                          "&code=" code)]
+        {:keys [client-id client-secret signing-secret]} (get-github-settings context)
+        {:keys [code state]} (:query-params request)]
     (go
-      ;; TODO Fetch auth code
-      (>! ch (assoc context :response (assoc response
-                                             :headers {"Content-Type" "text/html"}
-                                             :status 200
-                                             :body "Callback"))))
+      (if (= state signing-secret)
+        (let [access-token @(get-access-token {:query-params {:client_id client-id
+                                                              :client_secret client-secret
+                                                              :code code}
+                                               :headers {"Accept" "application/json"}})]
+          (if access-token
+            (>! ch (redirect-home context access-token))
+            (>! ch (redirect-home context))))
+        (>! ch (redirect-home context))))
     ch))

(ns wombats.handlers.auth
  (:require [io.pedestal.interceptor.helpers :refer [defbefore]]
            [clojure.core.async :refer [chan go >!]]
            [wombats.interceptors.github :refer [get-github-settings]]))

(def ^:private github-base "https://github.com/login/oauth/")

(def ^:private user-repos-url "https://api.github.com/user/repos")

(def ^:private github-scopes "user:email")

(defn- get-access-token
  "POST request to get a GitHub OAuth token.
  If no auth token is found, nil will return"
  [request-params]
  (http/post github-access-token-url
             request-params
             (fn [{:keys [body]}]
               (get (parse-string body true) :access_token nil))))

(defn- redirect-home
  "Final redirect home with or without access token appended"
  ([context]
   (assoc context :response (assoc (:response context)
                                   :headers {"Location" "/"}
                                   :status 302)))
  ([context access-token]
   (assoc context :response (assoc (:response context)
                                   :headers {"Location" (str "/?access-token=" access-token)}
                                   :status 302))))

;; TODO signing secret should not be consistant across requests. Gen uuid to send.
(defbefore github-redirect
